CVE-2022-1006 Advanced Booking Calendar < 1.7.1 - Admin+ SQLi

2022-04-1114:41:04

CWE-89

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

41.2%

JSON

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks

CNA Affected

[
  {
    "product": "Advanced Booking Calendar",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.7.1",
        "status": "affected",
        "version": "1.7.1",
        "versionType": "custom"
      }
    ]
  }
]